Technical Information
Malicious functions:
Substitutes application name for:
- dash-scheduler
- dash-http
- dash-httpworker
- dash-loadblk
- dash-ps
- dash-ps-client
- dash-torcontrol
- dash-net
- dash-opencon
- dash-addcon
- dash-mnbcon
- dash-dnsseed
- dash-msghand
- dash-wallet
Performs operations with the file system:
Creates folders:
- /root/.dashcore
- /root/.dashcore/backups
- /root/.dashcore/database
- /root/.dashcore/blocks
- /root/.dashcore/blocks/index
- /root/.dashcore/chainstate
Creates or modifies files:
- /root/.dashcore/dash.conf
- /root/.dashcore/masternode.conf
- /root/.dashcore/.lock
- /root/.dashcore/dashd.pid
- /root/.dashcore/debug.log
- /root/.dashcore/.cookie
- /root/.dashcore/db.log
- /root/.dashcore/blocks/index/LOCK
- /root/.dashcore/blocks/index/MANIFEST-000001
- /root/.dashcore/blocks/index/000001.dbtmp
- /root/.dashcore/blocks/index/000003.log
- /root/.dashcore/blocks/index/MANIFEST-000002
- /root/.dashcore/blocks/index/000002.dbtmp
- /root/.dashcore/chainstate/LOCK
- /root/.dashcore/chainstate/MANIFEST-000001
- /root/.dashcore/chainstate/000001.dbtmp
- /root/.dashcore/chainstate/000003.log
- /root/.dashcore/chainstate/MANIFEST-000002
- /root/.dashcore/chainstate/000002.dbtmp
- /root/.dashcore/blocks/blk00000.dat
- /root/.dashcore/blocks/rev00000.dat
- /root/.dashcore/database/log.0000000001
- /root/.dashcore/__db.80000001.de430178
- /root/.dashcore/wallet.dat
- /root/.dashcore/database/log.0000000002
- /root/.dashcore/backups/wallet.dat.2018-04-22-07-33
- /root/.dashcore/peers.dat.760e
- /root/.dashcore/banlist.dat.aab3
Deletes files:
- /root/.dashcore/blocks/index/MANIFEST-000001"
- /root/.dashcore/chainstate/MANIFEST-000001"
Network activity:
Awaits incoming connections on ports:
- 127.0.0.1:9998
- 0.0.0.0:9999
Establishes connection:
- 127.0.0.1:9051
- <LOCAL_DNS_SERVER>
- 37.###.151.228:0
- 35.##2.63.137:0
- 19#.##5.81.129:0
- 45.##.69.57:0
- 18#.##6.196.182:0
- 10#.##.218.245:0
- 23.##7.163.23:0
- 10#.##5.65.176:0
- 8.#.5.170:0
- 15#.#5.1.101:0
- 14#.#35.23.19:0
- 45.##.157.229:0
- 18#.#66.88.54:0
- 45.##.98.116:0
- 10#.#35.71.23:0
- 10#.##5.69.249:0
- 45.##.60.68:0
- 45.##.67.12:0
- 16#.##7.96.194:0
- 89.##.167.81:0
- 14#.##5.168.107:0
- 19#.##5.89.166:0
- 10#.##.185.249:0
- 19#.#35.94.7:0
- 17#.##2.194.93:0
- 19#.##.214.211:0
- 10#.#8.2.219:0
- 10#.#8.3.219:0
- [2#######0:2048:1::681c:2db]:0
- [2#######0:2048:1::681c:3db]:0
- 19#.##.214.211:9999
- 18#.##.222.220:0
- 13#.#9.74.251:0
- 10#.##7.151.111:0
- 19#.##5.83.189:0
- 12#.##9.32.144:0
- 34.##8.116.26:0
- 47.##.23.175:0
- 18#.##6.139.216:0
- 20#.#89.90.30:0
- 19#.##1.126.207:0
- 34.##8.2.134:0
- 83.##9.114.42:0
- 80.##0.27.150:0
- 84.##0.4.12:0
- 20#.##9.90.140:0
- 18#.##7.75.223:0
- 16#.#9.37.229:0
- 81.#.107.138:0
- 18#.#66.9.60:0
- 19#.##1.241.92:0
- 19#.##4.105.109:0
- 18#.#27.19.58:0
- 18#.##6.36.113:0
- 94.###.238.213:0
- 45.##.58.184:0
- [2##########:6ab8:20ee:348b:e7f0:28f7]:0
- [2########::f03c:91ff:feb9:c58a]:0
- [2#########8:6ab8:848:ed72:4316:8f96]:0
- [2#########5:79fb:802:31db:7277:a63b]:0
- [2#########5:79fb:400:7e78:51a6:ac73]:0
- [2#########8:6ab8:ce2:95c:4f8e:fb2e]:0
- [2#########7:2:20c:29ff:fe5a:a7ac]:0
- [2#########5:79fb:3405:d19:bb3c:e307]:0
- [2##########:79fb:3449:1373:3f29:34d1]:0
- [2#########8:6ab8:c63:3498:b199:244c]:0
- [2#########7:9e76:c38:85f:b1b8:dc1a]:0
- [2#########8:6abd:94:3909:ce18:103d]:0
- [2#########5:79fd:1059:f78:4e0e:25ce]:0
- [2#########0:d00:91c2:fad6:7deb:a1b8]:0
- 5.##.101.232:0
- [2#####000:6:65::9]:0
- 18#.##7.74.107:0
- 19#.##7.24.172:0
- 18#.##6.172.151:0
- 52.##.28.236:0
- 83.###.114.42:9999
- 21#.##6.121.100:0
- 20#.#89.8.86:0
- 21#.##0.140.66:0
- 14#.##.166.202:0
- 31.##0.62.126:0
- 22#.##6.137.151:0
- 18#.#27.72.45:0
- 54.##5.145.42:0
- 14#.##5.208.159:0
- 35.###.119.170:0
- 37.##.80.72:0
- 18#.#66.26.78:0
- 45.##.235.230:0
- 12#.#7.61.108:0
- 45.##.114.160:0
- 16#.#8.15.98:0
- 18#.#27.18.74:0
- 17#.##.210.149:0
- 19#.##.214.206:0
- [2##########:79fb:144d:20e0:e7b8:4b4f]:0
- [2#########5:79fb:1082:dc5:dc7a:7b38]:0
- [2#########5:79fb:8c0:21b1:d2d3:de1b]:0
- [2#########5:79fb:4b4:1076:e744:73a9]:0
- [2##########:6ab8:2832:d0af:430b:d97b]:0
- [2##########:79fb:10d1:1018:b1c7:944a]:0
- [2##########:9e76:383f:2b4e:add8:2bd5]:0
- [2##########:9e76:34bd:302b:bc55:b5ee]:0
- [2##########:9e76:1c03:37bc:3d19:60ac]:0
- [2##########:6abd:2cff:2304:b2b5:f6f4]:0
- [2#########5:79fb:1cc6:739:b9ca:35b2]:0
- [2##########:79fb:18f5:2e33:51b3:2663]:0
- 10#.#8.13.47:0
- 10#.#8.12.47:0
- [2#######0:2048:1::681c:d2f]:0
- [2#######0:2048:1::681c:c2f]:0
DNS ASK:
- dn####d.dash.org
- da##.org
- dn####d.dashdot.io
- da##dot.io
- dn#####.masternode.io
- ma###rnode.io
- dn####d.dashpay.io
Sends data to the following servers:
- 19#.##.214.211:9999
- 83.###.114.42:9999
Receives data from the following servers:
- 19#.##.214.211:9999
- 83.###.114.42:9999
Other:
Collects CPU information
Collects RAM information
